3 ms·

Also, Twitter is a great big centralized system- it seems like it ought to make public key distribution very easy and straightforward.

• djbusby 4y ago
  Wasn't that what KeyBase was supposed to do?
  • ttyprintk 4y ago
    And GitHub is beating Keybase at
    • brigandish 4y ago
      Care to expand on that?
      • ttyprintk 4y ago
        As we see signing support for ssh keys, the automatic hosting of keys from https://GitHub.com/your-name-here.keys https://GitHub.com/your-name-here.keys and the corresponding gpg.
        • djbusby 4y ago
          Why did I learn this from you and not some docs? Maybe cause I'm here more often than GH.
          • ttyprintk 4y ago
            It’s possible GitHub doesn’t want to publicize it widely. Using those keys, it’s possible for a server to identify you from a connection attempt: https://words.filippo.io/ssh-whoami-filippo-io/ https://words.filippo.io/ssh-whoami-filippo-io/
        • brigandish 4y ago
          Thanks, and interesting info linked below (with explanation linked to here[1]) that made OpenSSH clients versions 5.4 to 7.1 vulnerable: > Although roaming is not supported by the OpenSSH server, it is enabled by default in the OpenSSH client, and contains two vulnerabilities that can be exploited by a malicious SSH server (or a trusted but compromised server): an information leak (memory disclosure), and a buffer overflow (heap-based). [1] https://www.qualys.com/2016/01/14/cve-2016-0777-cve-2016-0778/openssh-cve-2016-0777-cve-2016-0778.txt https://www.qualys.com/2016/01/14/cve-2016-0777-cve-2016-077...